System Security V2

System Security V2

1. Forms of Attack

   • Malware
     • Software written to infect, damage or gain unauthorized access to computer systems
       • Files are deleted, become corrupt or encrypted, Computers crash, refresh spontaneously and slow down, Internet connections become slow
     • Types of Malware
       • Viruses - Attaches itself to programs or files on a computer or server to harm the computer system; it affects all components of the OS
       • Worms - Replicates itself through a computer network via vulnerabilities in the network to spread to other computers; it does not need to attach to a program
       • Trojan Horses - Designed to access a computer by misleading users of its intent e.g. Fake message which randomly comes up telling you to download something 'to protect against viruses'
   • Phishing
     • A form of 'social' engineering' (Human interaction used on people normally to break normal security procedures)
     • Usually done by email but can also be done by phone to trick people into giving away information like their bank details etc.
     • Done by tricking or enticing people to disclose personal information e.g. usernames, passwords credit card details etc.
   • Brute Force
     • A trial and error method used for gaining access to password-based entry systems
     • Consists of exhausted effort with a lot of generated guesses until finding the correct username/password
   • DDoS (Distributed Denial of Service)
     • Floods a sever (website) with useless traffic, overloading it via infected machines in a network so it cannot respond to legitimate requests by the user and would go offline
     • Used as a 'botnet' (a number of Internet-connected devices, each of which is running one or more bots to do any purpose needed)
     • If successful, access to the server is lost or at least lower productivity within the server
   • Data Interception and Theft
     • Data streams and packets that travel across networks can be intercepted into in order to obtain plain text passwords, configuration information or the data itself
     • Data can also be intercepted physically a.k.a. stealing a hard drive or other external hardware
   • SQL Injection
     • A code injection technique used to attack data-driven applications and access databases that use SQL
     • Insecure SQL code in the database programs can exploited and be 'injected' (changed) with new coding that could do harmful things when executed by the server
     • SQL - Programming language
       • Companies that use SQL: Google, YouTube, PayPal, eBay
     • If successful in gaining access to the database, they can alter, expose or delete data at will; they can also impersonate specific users of the database

2. Threats Posed to Networks

   • Poor Network Policy
     • What well-managed networks should have
       • A Data Protection Act
       • Acceptable Use Agreements
       • Network managers who understand, identify and actively protect against invulnerabilities
       • Permissions set to access servers, files, systems and databases
   • People as a 'weak point'
     • Not locking doors to computer rooms
     • Losing memory sticks/laptops
     • Leaving printouts on desk
     • Not installing OS (Operating System) updates & keeping anti-malware software up-to-date
     • Writing down passwords and sharing them out in the open
     • Not applying security to wireless networks or encrypting data

3. Identifying and Preventing Vulnerabilities

   • Anti-Malware Software - Prevents malware from entering the system (Malware)
   • Encryption - Where data is translated into the code so that only authorized users or users with the key can decrypt it; users must need the key in order to decrypt the coded file (Data Interception and Theft)
   • Network Forensics - Examines data sent across a network via 'packet sniffing' (involves intercepting packets being sent around a network, allowing to see what is being sent at all times (Data Interception and Theft)
   • Penetration Testing - Person checks current vulnerabilities and potential ones in order to avoid weaknesses which can be exploited by malicious people (SQL Injection)
   • Firewall - Performs a barrier between a attacker and the computer system; has the ability to block access from certain computer users and disable processes etc. (DDoS)
   • User Access Levels/System Access Rights - Selects a hierarchy of users: lower level users have limited information, higher level users have more sensitive data (Phishing)
   • Network Lockout Policy - Locks account after 3 attempts, Staff Training (using effective passwords with numbers and symbols etc.), (Brute Force)
   • Biometric Security - Alternates to password e.g. Retina Scan, Fingerprint, Voice, Facial Recognition
   • Staff Training
   • Staff Training